The call that sounds like help
Canada’s cyber security centre warns of an ongoing campaign against organisations including law firms and financial businesses. Callers impersonate internal IT and claim an urgent passkey, MFA or password change is needed. Caller ID can be spoofed. [1] [3]
- Impersonated support call
- Counterfeit sign-in
- Session taken over
- Access to business data
How a sign-in becomes someone else’s session
The target is directed to an imitation sign-in page. A relay can forward credentials and some MFA responses to the legitimate identity provider in real time, allowing an attacker to obtain an authenticated session. This does not mean every MFA method can be defeated this way. [1] [3]
Controls that interrupt the chain
Independently verify unexpected calls using an established internal number. Use phishing-resistant methods such as FIDO2 security keys or device-bound passkeys for sensitive accounts. Protect account recovery, MFA resets and new-device enrolment against social engineering too. [1] [2]
What to do if compromise is suspected
Report through the established internal channel. Have authorised administrators revoke active sessions and tokens, reset credentials and remove unauthorised MFA methods. Preserve sign-in, mailbox and file activity logs for investigation. Adapt the response to the actual incident and environment. [1] [3]